As more is revealed about the Wieambilla shooters, some question why Gareth Train was not on authorities’ radar

The four young Queensland police officers didn't see it coming.One moment, they were walking down a driveway towards a weatherboard house in the state's Western Downs region to check on a missing person.

The next, two were shot dead, one was running for his life with a bullet wound, and another was hiding in long grass, fearing a fire lit by her attackers would burn her alive.

They wouldn't have known that, two days earlier, one of the men shooting at them had shared a video online. In it, Gareth Train's voice is distorted and his words sometimes incoherent. But his message is sinister.

The video starts with the opening credits to the TV show Cops, before Gareth reads out a New South Wales missing persons release relating to his brother Nathaniel.

It ends with him saying: "You wish to make this public by using my little brother?" The final frame shows an image of an axe and a dagger.

It is the one of the final videos posted by Gareth before he and his wife, Stacey, and his brother Nathaniel murdered two police officers and a neighbour.

Police are investigating whether the officers had been lured to the property on Monday afternoon.

But also central to investigations into the activities of the Train family are how they escaped the attention of authorities in the months before the attack. Gareth in particular posted frequently on conspiracy websites using his real name or thinly veiled aliases.

Guardian Australia understands many of Gareth's online activities only came to the attention of authorities in Queensland and NSW after the shooting.

A former long-serving national security official, who asked not to be named and spoke before the emergence of Gareth's videos, says he is "utterly baffled" that other posts on publicly available websites were not on the radar of authorities.

"I suspect they were not really looking at these sites - or if they were, they did not understand what they were seeing," he says.

The former official says Gareth's posting and "narrative arc" seemed to exceed the threshold where he would be considered a threat.

"And Gareth Train's comments stick out."

Gareth posted at least 12 videos online in the six weeks prior to the attack, railing against police, sometimes by name. At least two feature vision of the director general of intelligence agency Asio, Mike Burgess.

He also regularly wrote anti-government and anti-police messages on other websites, often interwoven with conspiracy theories, including that the Port Arthur massacre was a "false flag" operation.

The visit by police to the remote property, in an area known as the blocks, was given a risk assessment of "business as usual", the Queensland police commissioner, Katarina Carroll, confirmed this week, indicating local officers had no access to information that suggested there was something to fear.

Experts on sovereign citizens and far-right extremism are concerned the threat posed by such movements is not being taken seriously.

In February the Australian federal police provided an unclassified briefing on the growth of sovereign citizens in Australia and the current threat of violent extremism being committed by people within the movement.

But one person who attended the briefing, speaking on condition of anonymity as the forum was not to be discussed publicly, says they were shocked at how little the AFP appeared to understand about the movement, and its potential for violence.

"I felt the Australian federal police didn't have a very sophisticated understanding of sovereign citizens," the person says.

"They downplayed the threat of violence from sovereign citizens, which shocked me given the targeting and murder of law enforcement officers by sovereign citizens in America."

Gareth and Stacey Train are now known to have been in contact with another religious conspiracy theorist in the US, where the movement has been linked to the murder of police.

The AFP declined to comment on criticisms of the briefing, or on a range of other questions.

The attender says that at the time of the briefing, Australian sovereign citizens had already shown they were capable of acting on their beliefs, including during an attempted takeover of Canberra's tent embassy, and alleged arson attacks on Old Parliament House.

Police also investigated the movement's links to attacks on mobile phone towers.

Lydia Khalil, an expert in extremism and a research fellow at the Lowy Institute and Deakin University, who hosted the forum which featured the AFP, declined to comment on the presentation as it was conducted under Chatham House rule.

But she says the Trains' attack would "change how researchers and government agencies calculate the risk of violence that they pose, because we now have a clear example - a precedent - of this type of conspiratorial behaviour leading to violence".

Typically, terror suspects are identified and monitored by intelligence agencies, who then pass any information they have to relevant law enforcement bodies, such as state and federal police.

Asio declined to say whether it had been monitoring the Trains prior to the shooting incident.

Burgess said earlier this year that the agency had seen "a distinct increase in radicalisation and specific-issue grievances", even as the overall terrorism caseload had declined.

In his annual threat assessment, he said a growing number of individuals were "motivated by a fear of societal collapse or a specific social or economic grievance or conspiracy".

He said such individuals were harder for security agencies to assess as "many of the actors are newcomers, so it's harder to get a sense of what is simply big talk and what is genuine planning for violence".

Dr Emily Corner, a senior lecturer of criminology at the Australian National University, says Gareth's posts would have met "quite a few different markers" of the TRAP-18 assessment used to identify terror threats by lone actors.

Dr Mario Peucker, a senior research fellow at Victoria University, says the fact Stacey quit her job as a teacher because of the vaccination mandate suggests a potential willingness to act on her beliefs.

Experts also say Nathaniel Train's behaviour could have also raised concerns.

In late 2020, while he was still working as a school principal in the NSW town of Walgett, Nathaniel spent $288,000 a block of land in Moruya, on the state's south coast, with his partner.

The pair taught together in Walgett, in the state's west, and had both been teachers at Trinity Beach state school, north of Cairns in Queensland.

Nathaniel suffered a heart attack at Walgett about eight months after the couple bought the block of land, which signalled the effective end of his teaching career.

By March this year, emails he sent to the head of the NSW education department and union officials outlined the extent of his displeasure with his former profession.

In one, he says he was speaking with a psychologist provided by WorkCover, and urged the teacher's federation to take care of his partner so she was not "unduly targeted over the next little period" as a result of the criticisms he had made of the department.

At this point, he had not seen his partner for almost three months. When he stopped making contact in October 2021, she reported him missing to NSW police. She could not be contacted by Guardian Australia.

Carroll has made clear she will provide answers about why the Trains did what they did.

- with Daniel Hurst